| 1 | name: Web Frontend |
| 2 | |
| 3 | on: |
| 4 | push: |
| 5 | branches: [master, main] |
| 6 | pull_request: |
| 7 | branches: [master, main] |
| 8 | workflow_dispatch: |
| 9 | |
| 10 | permissions: |
| 11 | contents: read |
| 12 | |
| 13 | jobs: |
| 14 | lint: |
| 15 | name: Lint & Type Check |
| 16 | runs-on: ubuntu-latest |
| 17 | defaults: |
| 18 | run: |
| 19 | working-directory: web |
| 20 | steps: |
| 21 | - uses: actions/checkout@v7 |
| 22 | - uses: actions/setup-node@v7 |
| 23 | with: |
| 24 | node-version: 22 |
| 25 | cache: 'npm' |
| 26 | cache-dependency-path: web/package-lock.json |
| 27 | - name: Install dependencies |
| 28 | run: npm ci |
| 29 | - name: Check facts drift |
| 30 | # facts.generated.ts is TRACKED (committed), so verify the committed |
| 31 | # copy matches the workspace BEFORE regenerating. Running prebuild first |
| 32 | # would self-heal the working tree and let a stale committed file pass |
| 33 | # (#3771). check:facts ignores the volatile generatedAt/latestRelease |
| 34 | # fields by design, so it is safe to run against the committed copy that |
| 35 | # exists at checkout. |
| 36 | run: npm run check:facts |
| 37 | - name: Generate derived facts |
| 38 | # Regenerate after the drift gate so tsc --noEmit (TS2307 without it) and |
| 39 | # the build use a current facts.generated.ts. When the gate passes this |
| 40 | # only refreshes the generatedAt timestamp. |
| 41 | run: npm run prebuild |
| 42 | - name: Check docs parity |
| 43 | # Fails CI when docs-map.ts references non-existent repo files or |
| 44 | # when website version / command snippets are stale. |
| 45 | run: npm run check:docs |
| 46 | - name: Run tests |
| 47 | run: npm test |
| 48 | - name: Run ESLint |
| 49 | run: npm run lint |
| 50 | - name: TypeScript type check |
| 51 | run: npx tsc --noEmit |
| 52 | - name: Build production site |
| 53 | run: npm run build |
| 54 | |
| 55 | deploy: |
| 56 | name: Deploy to Cloudflare |
| 57 | runs-on: ubuntu-latest |
| 58 | needs: lint |
| 59 | # Deploy is MANUAL ONLY: a human dispatches this workflow on main. Pushes |
| 60 | # and pull requests still run `lint` above, but they never reach Cloudflare. |
| 61 | # This mirrors scripts/check-cloudflare-deploy-env.mjs, which fails closed |
| 62 | # unless GITHUB_EVENT_NAME is workflow_dispatch, GITHUB_REF is |
| 63 | # refs/heads/main, and GITHUB_SHA is an exact 40-hex revision — a push |
| 64 | # trigger here would only produce a red job after `lint` had already run. |
| 65 | # lib/deploy-preflight.test.ts asserts both halves of that contract. |
| 66 | # `needs: lint` is the gate: facts drift, docs parity, tests, ESLint, tsc, |
| 67 | # and a production build all pass before anything reaches Cloudflare. |
| 68 | if: >- |
| 69 | github.event_name == 'workflow_dispatch' |
| 70 | && github.ref == 'refs/heads/main' |
| 71 | # Serialize deploys so two dispatches landing close together cannot race and |
| 72 | # leave Cloudflare serving the older bundle. Never cancel in progress: a |
| 73 | # half-finished OpenNext upload is worse than a queued one. |
| 74 | concurrency: |
| 75 | group: deploy-codewhale-web |
| 76 | cancel-in-progress: false |
| 77 | defaults: |
| 78 | run: |
| 79 | working-directory: web |
| 80 | env: |
| 81 | CLOUDFLARE_ACCOUNT_ID: ${{ vars.CLOUDFLARE_ACCOUNT_ID }} |
| 82 | CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }} |
| 83 | steps: |
| 84 | - uses: actions/checkout@v7 |
| 85 | # Pin the checkout to the exact revision this dispatch resolved, so the |
| 86 | # SHA reported to compare:deployed-facts and asserted on the public |
| 87 | # receipt below is the SHA that was actually built, even if main moves |
| 88 | # while the run is queued behind the concurrency group. |
| 89 | with: |
| 90 | ref: ${{ github.sha }} |
| 91 | - uses: actions/setup-node@v7 |
| 92 | with: |
| 93 | node-version: 22 |
| 94 | cache: 'npm' |
| 95 | cache-dependency-path: web/package-lock.json |
| 96 | - name: Install dependencies |
| 97 | run: npm ci |
| 98 | - name: Record deployed/source drift |
| 99 | # Read-only and credential-free. A mismatch is the normal state here — |
| 100 | # it is the gap this run is about to close — so this step reports |
| 101 | # without gating. The real assertion is the post-deploy verification |
| 102 | # below, which must observe this exact revision on the public receipt. |
| 103 | run: npm run compare:deployed-facts -- --expected-revision "$GITHUB_SHA" |
| 104 | - name: Check Cloudflare deploy environment |
| 105 | run: npm run check:deploy-env |
| 106 | - name: Build OpenNext bundle |
| 107 | run: npm run build && npx opennextjs-cloudflare build |
| 108 | - name: Deploy |
| 109 | run: npm run deploy |
| 110 | - name: Verify exact deployed revision |
| 111 | # The public /api/facts receipt must identify this workflow's exact |
| 112 | # checkout before the manual deployment run can finish green. |
| 113 | run: npm run check:deployed-facts -- --expected-revision "$GITHUB_SHA" --attempts 10 --retry-delay-ms 3000 |
| 114 |